Differential privacy: a mathematical limit on what a release reveals

Differential privacy is a mathematical framework that limits how much any single person’s data can affect a published result. NIST describes it as “a mathematical framework that quantifies privacy loss to entities when their data appears in a dataset.” It works by adding calibrated random noise. The protection is strong and provable, but it reduces accuracy, and the reduction hits small groups hardest.

Definition

NIST SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees (March 2025), states the core promise: “a reduction in privacy caused by a data analysis or published dataset will be bounded for all individuals about whom data are found in the dataset,” so that any privacy reduction “could have happened even if the individual had not contributed their data”.⁠¹ Its key takeaway: “the chance of an outcome is about the same whether or not an individual contributes their data”.⁠¹

Two settings define a guarantee:⁠¹

• The privacy parameter, epsilon (ε). “Smaller ε means stronger privacy but lower accuracy.”
• The unit of privacy. What counts as one person’s contribution: a single event, or everything a user contributed. NIST states that the guarantee “is defined by both the privacy parameters (e.g., ε) and the unit of privacy.”

Differential privacy does not stop all inferences. NIST’s example: if statistics show that most people have eyebrows, one can infer that Joe probably does, whether or not Joe’s data was used.⁠¹

Origin and history

NIST notes that “differential privacy was first defined in 2006 as a theoretical framework and is still making the transition from theory to practice”.⁠¹ It arose because older approaches failed. NIST recounts that in 1997 researchers used gender, ZIP code, and birth date from public voter registration data to re-identify individuals in de-identified medical records, including Massachusetts Governor William Weld.⁠¹ NIST also warns that “publishing enough statistics will always result in accurate reconstruction attacks”.⁠¹

A prominent public deployment was the 2020 U.S. Census. The Census Bureau describes differential privacy as “a framework for measuring the precise disclosure risk associated with each release of confidential data”.⁠² As of the Bureau’s page revised June 18, 2026, that information “is no longer current”: the Bureau states it is evaluating alternatives to comply with a Commerce Department administrative order that prohibits noise infusion, with updated guidance pending.⁠² The policy is therefore in flux, and readers should check the Bureau’s current guidance.

How differential privacy is used

Organizations apply differential privacy in two main models:⁠¹

• Central model. A trusted curator holds the real data and adds noise to the outputs.
• Local model. “Each individual adds noise to their own data before sending it to the data curator,” so the curator “does not need to be trusted.” The cost is accuracy: NIST notes the local model “is only useful for queries with a very strong ‘signal’.”

The accuracy cost is uneven. NIST lists as a privacy hazard that “differential privacy can magnify or create systemic bias,” because the same absolute noise is large relative to a small group’s count.⁠¹ NIST adds that this type of bias “is an unavoidable property of any robust anonymization mechanism, and is not unique to differential privacy”.⁠¹ Whether the accuracy cost is worth the protection, especially for small communities whose counts carry legal and funding weight, is a policy choice, and it is contested.

Common confusions and neighboring terms

• Differential privacy vs. de-identification. Removing names leaves data open to linkage. Differential privacy bounds risk even against outside data.
• Differential privacy vs. k-anonymity. k-anonymity is a property of a table; differential privacy is a property of the process that produces outputs.
• Differential privacy vs. synthetic data. Synthetic data can be produced with or without it; NIST warns that without it, synthetic data “may be susceptible to privacy attacks”.⁠¹
• Differential privacy vs. “anonymous.” It gives a quantified bound, not absolute anonymity.

How My Vote Forward uses the term

My Vote Forward lists differential privacy as one candidate method for protecting aggregates before any release of real data. The framework has not chosen a method; its Published releases chapter requires a documented privacy design that sets statistical methods and minimum group sizes first. Demo data is synthetic, so no differential privacy is applied or claimed there.

Unresolved questions

• What epsilon, if any, would be appropriate for priorities in a small district, where noise could swamp the result?
• Should the unit of privacy be one answer or a person’s entire history of participation?
• How should noisy results be explained so that readers do not mistake noise for real change?